Tutorials Web Development

How to Change the WordPress Login Page Without a Plugin

No ratings yet.

WordPress installations are pretty standardized everywhere. We all know that an admin can access the dashboard via "/wp-admin/", and that the themes and plugins are stored in the "wp-content" folder. Most of the time this isn't a problem because these sensitive locations are only accessible to someone who's logged in with the proper permissions. The one exception? The login page! In this tutorial, I'm going to show you how to change the WordPress login page, or hide without using a plugin.


Why Hide the Login Page?

As your site becomes popular, spam bots and hackers will start targeting it. And the first point of attack is the login page.

Now you might be thinking "I don't mind. I have a strong username and password!". And that's great! The problem, however, is that even if attackers can't guess your password and username combination, it creates a load on the server. Here's the default login page for all WordPress websites:

WordPress login page

Merely by accessing wp-login.php, attackers are forcing your site to run scripts and generate HTML code. Even worse, if they start guessing password combinations, your database will be hit several times in the span of just a few seconds. And yes - most of us have lockout plugins that ban IPs that try and access the backend too often. But this won't save you from a distributed attack.

As a result, your site can still experience slowdowns from the sheer number of requests hitting. Ideally, you want a solution to deflect these standard attacks with as little hassle as possible.

I speak from personal experience. DDoS attacks have bombarded my own wp-login.php page, crippling my site. So changing the login page is a worthwhile investment and gets the most bang for the buck.

So let's see how to do this.


The End Result

At the end of this tutorial, we will change your login page from:

example.com/wp-login.php

to

example.com/wp-login.php?newlogin

The "newlogin" parameter can be anything you choose. It'll be known only to you. Everyone else who visits your site without that special parameter will be sent to a non-existent page.


Step 1: Access Your Theme's functions.php

This technique doesn't require you to install any plugins. Instead, we're going to add code to your theme's functions.php file. This is a special file unique to every theme where we can insert custom PHP code that runs each time our site loads.

From the WordPress administration dashboard, select Appearance -> Editor as shown here:

WordPress login page

If you're doing this for the first time, you'll likely see a warning about editing theme files. Press "I Understand" and continue.

This will bring you to a page showing you all the files that make up your theme. Your current theme will already be selected in the drop-down box as shown here:

WordPress login page

In the list of files below, select "Theme Functions (functions.php)". This will open functions.php in the text editor on the left-hand side for editing.


Step 2: Safely Editing functions.php

A warning here. The functions.php file is linked to your theme and it's dangerous. If something goes wrong, your theme could crash. To avoid this, I recommend one of the following:

  1. Access functions.php from your cPanel backend instead of through WordPress. This way if your site crashes, you can easily delete the code you just added instead of being locked out.
  2. Use a separate plugin for custom PHP code. I personally prefer this second option. This way, if something goes wrong, only the plugin will be disabled, and your theme/site will continue working.

Another warning. When the functions.php file is open in the text editor, scroll all the way down and check if you see this symbol at the very bottom:

?>

If you do see it, delete it. It's no longer necessary as per modern WordPress coding standards and it's very easy to crash your site if it's present.

Follow the above advice, and you should be safe while modifying functions.php


Step 3: Adding Code to functions.php

Once functions.php is open in the editor on the left-hand side, paste the following into it:

function redirect_to_nonexistent_page(){

     $new_login=  'newlogin';
    if(strpos($_SERVER['REQUEST_URI'], $new_login) === false){
                wp_safe_redirect( home_url( 'NonExistentPage' ), 302 );
      exit(); 
    }
 }
add_action( 'login_head', 'redirect_to_nonexistent_page');

function redirect_to_actual_login(){
 
  $new_login =  'newlogin';
  if(parse_url($_SERVER['REQUEST_URI'],PHP_URL_QUERY) == $new_login&& ($_GET['redirect'] !== false)){     
                 wp_safe_redirect(home_url("wp-login.php?$new_login&redirect=false"));
     exit();
 
  }
}
add_action( 'init', 'redirect_to_actual_login');

There are two items in bold in the above code. This is the custom slug that you choose to access your login page. Replace it with something of your choice. Something that's not easy for anyone to guess.

Here's what it looks like with the code added to functions.php

WordPress login page

Once inserted and modified, click the blue "Update File" button as shown above.


Step 4: Accessing Your Login Page

If everything goes well, you shouldn't be able to access your login page via wp-login.php anymore. If you try, you'll be redirected to a non-existent page like this:

Instead, access your login page like this:

WordPress login page

example.com/wp-login.php?newlogin

Replace newlogin with whatever slug you chose in Step 3. Now your login page will be visible like this:

WordPress login page

And that's it! You've successfully managed to change your wp-login.php page and made it so that hackers can't access it anymore!

Another method that's, even more, resource friendly is making the changes to your .htaccess file so that visitors are redirected from there. But .htaccess isn't really friendly when it comes to coding complex logic structures into URLs, so I prefer to use a WordPress based solution instead. Plus, it's portable and a lot less scary to modify functions.php compared to .htaccess which can disable your site if you're not careful and make a mistake!



Read Also

How to Create a Sticky Menu on WordPress

WordPress Gutenberg is Close to Becoming a Default Editor

Top 15 WordPress SEO Mistakes to Avoid

Jupiter 5 vs. Monstroid 2: Cosmic WordPress Themes to Give You Goosebumps

3 Responses

  1. HostGator only requires that the website be cleaned up for them to unsuspend it, not that you hire SiteLock to clean it up. They usually clearly state that in the emails they send out when suspending websites and we have never had any issue with them unsuspending a website after we have done a cleanup for someone.While moving to a new web host may be a good idea, that won’t do anything about the hack if it is in fact hacked. So there would still need to be a cleanup done. It would be better to clean it before you move it, not only so you don’t bring anything malicious to the hosting environment, but more importantly because there could be important information needed to best clean and secure the website that could be lost during the move.

  2. Can we transfer the site to the homepage instead of “NonExistantPage”

  3. Hi,
    Wanted to thank you for a very simple but hopefully effective way to hold off the spammers and bots!

Leave a Reply

Your email address will not be published. Required fields are marked *